The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx -y @midscene/computer@1 to download and execute code directly from the npm registry. This introduces a dependency on third-party software that is fetched at runtime, creating a supply chain risk if the package or registry is compromised.
[DATA_EXFILTRATION]: To perform its tasks, the skill captures screenshots of the entire desktop via the take_screenshot command. These images may contain sensitive personal data, credentials, or private documents visible on the screen, which are then transmitted to external AI model providers for processing.
[INDIRECT_PROMPT_INJECTION]: The skill interprets visual content on the screen to decide on actions. If a user opens a malicious website, document, or email that contains adversarial instructions, the agent might interpret that text as a command and execute it.
Ingestion points: Visual screenshots of the desktop captured by the take_screenshot command (SKILL.md).
Boundary markers: No explicit visual delimiters or filtering instructions are provided to help the agent distinguish between user instructions and text appearing on the screen.
Capability inventory: Full mouse and keyboard control via the act command and arbitrary shell command execution via the Bash tool.
Sanitization: No sanitization or validation of the text extracted from screen captures is performed before being used for action planning.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute its core automation CLI commands.
[CREDENTIALS_UNSAFE]: The skill requires sensitive information such as AI model API keys and RDP credentials. While it advises against hardcoding secrets, it suggests passing passwords in shell variables within CLI flags (e.g., --password "$RDP_PASSWORD"), which can potentially leak sensitive data into process listings or shell history logs.

computer-automation